CVE-2022-23765

This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:iptime:nas1dual_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:iptime:nas1dual:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:iptime:nas2dual_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:iptime:nas2dual:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:iptime:nas4dual_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:iptime:nas4dual:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-08-17 21:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-23765

Mitre link : CVE-2022-23765

CVE.ORG link : CVE-2022-23765

JSON object : View

Products Affected

iptime

nas1dual
nas4dual
nas4dual_firmware
nas1dual_firmware
nas2dual_firmware
nas2dual

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-23765", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "vuln@krcert.or.kr", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2022-08-17T21:15:08.907", "references": [{"url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877", "tags": ["Third Party Advisory"], "source": "vuln@krcert.or.kr"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}, {"type": "Secondary", "source": "vuln@krcert.or.kr", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request."}, {"lang": "es", "value": "Esta vulnerabilidad es producida al enviar una petici\u00f3n POST maliciosa a una p\u00e1gina espec\u00edfica mientras ha sido iniciada una sesi\u00f3n con un usuario aleatorio de alguna familia de IPTIME NAS. Los atacantes remotos pueden robar privilegios de root al cambiar la contrase\u00f1a del mismo mediante una petici\u00f3n POST."}], "lastModified": "2022-08-19T17:53:07.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:iptime:nas1dual_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90965263-2D84-4742-B60E-0A6738D9F329", "versionEndExcluding": "1.4.86"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:iptime:nas1dual:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2ACEC464-70B3-452B-A1A3-594C697E3AB3"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:iptime:nas2dual_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C67D4CA9-5991-4E37-B3E4-F39A49E949E8", "versionEndExcluding": "1.4.86"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:iptime:nas2dual:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "271D21D5-A55E-4D4F-8473-5A7A67573DEA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:iptime:nas4dual_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D302186C-3FF6-49F2-9622-ED3FB06F9EE1", "versionEndExcluding": "1.4.86"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:iptime:nas4dual:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0429CC1A-B95C-4FB0-90D6-D6CAD8E1CC14"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vuln@krcert.or.kr"}